HTTP Request
Sends an HTTP request to any URL and makes the response available to later steps. Reach for it whenever you need a service that has no integration of its own—fetching a list to loop over, posting a record to a partner system, calling an internal API.
Fields
| Field | Description |
|---|---|
| Method | The HTTP method: GET, POST, PUT, PATCH, DELETE, HEAD, or OPTIONS. |
| URL | The request URL. Accepts variables. |
| Query Parameters | Name/value pairs appended to the URL. Each row can be switched off without deleting it. |
| Headers | Request headers, each row switchable the same way. |
| Body | The request body, for methods that carry one. Raw takes a Content Type and the content itself; Form URL-Encoded takes a list of name/value Fields; File streams a file from an earlier step as the whole body, with the file's own content type, for raw upload endpoints; Multipart Form sends text Fields and Files together as multipart/form-data, for attachment and upload endpoints, each file under a part Name and with a File Name that defaults to the file's own. Files are streamed from storage, so an upload is bounded by the storage, not by memory. |
| Auth | Optional authentication applied to the request: Basic (username and password), Bearer Token, API Key (a Key Name and Key Value, placed in a header or the query string), or Client Credentials. |
| Follow Redirects | Whether to follow redirects. On when left unset. |
| Fail On Error Status | When on, a non-success status fails the step so the flow can follow its error path. Off when left unset. |
Advanced
| Field | Description |
|---|---|
| Connect Timeout (ms), Read Timeout (ms) | Per-request timeouts. A read timeout longer than the automation's execution timeout is flagged, since the automation would give up before the request did. |
| Response Destination | How the response body is captured: Discard (status only), Headers Only, Inline (the body travels in the payload), Storage (streamed to storage), or Automatic—inline, spilling to storage when the body is too large. Automatic when left unset. |
| Inline Response: Max Size and its Unit | The ceiling for an inline body. 1 MB when left unset. |
| Storage Response: Max Size and its Unit | The ceiling for a body streamed to storage. 10 MB when left unset. |
| Dry Run: Outbound HTTP | Which requests this step is allowed to send during a dry run: None, Safe Methods Only, or All Methods. Leave unset to inherit the default from the Settings page. |
| Resilience | Optional retry, timeout, and circuit breaking for this step. Leave it empty and a failure is terminal. |
Resilience in detail
| Field | Description |
|---|---|
| Max Retries | How many times to retry a failed request. Zero disables retrying. |
| Initial Retry Delay, Backoff Multiplier, Max Retry Delay | How long to wait before each retry, and how fast that wait grows. |
| Jitter | Randomizes each delay by up to half, so many failing runs don't retry in lockstep and hit the endpoint together. |
| Attempt Timeout | Fails a single attempt that runs too long, independently of the retry schedule. |
| Enable Circuit Breaker, with a Failure Threshold and Open Duration | After enough consecutive failures, requests fail fast for a while instead of hammering an endpoint that is already struggling. |
Retries are durable—a long backoff survives a server restart—and every attempt is recorded, so the step's history shows the whole sequence rather than just the last try.
What later steps see
| Value | Description |
|---|---|
| Status, Status Text | The HTTP status code and its text. |
| Headers | The response headers. |
| Cookies | Any cookies the response set. |
| Body (Raw) | The body as text, in inline and automatic modes. |
| Body (JSON) | The parsed body, when the response is JSON, in inline and automatic modes. |
| Body (File) | The stored body as a file, in storage and automatic modes: its Storage, Path, Content Type, and Metadata, which is what a later step needs to open it, its Public URL, and its Size (bytes). The variable picker shows it as a file, named by its filename and content type. The file is deleted when the run is archived. |
During a dry run
Whether a request actually leaves the system during a dry run is a policy decision, because HTTP's own notion of a "safe" method is only a convention an endpoint is free to break.
- None—nothing is sent. Every call is logged with its method and URL, and the step returns its Test Output instead of a real response.
- Safe Methods Only—GET, HEAD, OPTIONS, and TRACE are sent for real so later steps see live data; POST, PUT, PATCH, and DELETE are logged and skipped. This is what applies when neither the step nor the Settings page sets a policy.
- All Methods—everything is sent, including the mutating requests. A dry run rehearses nothing about outbound HTTP under this policy, so choose it only when the endpoints are themselves test targets.
Gotchas
Requests to loopback, link-local, private, carrier-grade NAT, and multicast addresses are refused, including when a public hostname—or a redirect—resolves to one; every hop is checked, not just the address you typed. That closes off the classic path to a server's own internal services and cloud metadata endpoints, and it means an internal service can only be reached if your administrator has published it or has allowed local network requests for the whole deployment.